Filebeat and incompatible CentOS

Elastic Stack Beats
1

Hey All,

Our IT department was tasked with finding and implementing a new log parser for our servers and we chose the ELK solution.

Everything went smooth until we tried to installing filebeat on the servers.

We are running CentOS 5.0 with a kernel 2.6.18 ( too old to support go ) and we can't upgrade.

We have also looked at other solutions such as beaver ( our python version is too old, again can't upgrade it )

So we've been brainstorming on a way around the issue and I would like to ask for advice on a (probably terrible) idea we came up with.

Could it be possible to run the filebeat application on a second server that will pull the few servers that are problematic over ssh? What would the downside be?

Any other solution is also acceptable, of course.

Thanks a bunch.

2

ship logs with syslog and ingest them to ELK with logstash TCP or SYSLOG input?

3

Would it be possible to install Logstash directly on these few servers? Not sure if the ssh solution will work. Filebeat has also issues reading files from shared volumes as sometimes the file identifiers change.